A VERY STRANGE THING....

[g.rodegari]

HI,

I' VE CONFIGURED A VPN LAN TO LAN FROM A PIX 506 [ VER 6.1(1) ] TO A PIX 515 [ VER 6.2(1) ].

ON THE 515 I' VE CONFIGURED THE "SYSOPT CONNECTION PERMIT-IPSEC", ON THE 506 NO! AND, CLEARLY, THE IPSEC DOESN'T WORK!

IF I PUT A "CONDUIT PERMIT IPSEC ANY ANY" ON THE 506...

THE TUNNEL WORKS WELL ! ! ! ! ! ! ! ! WHY? WHAT IS THE RELATIONSHIP BETWEEN IPSEC/IKE AND ICMP ? ? ?

NOTHING ! ,

I THINK...

THANKS,

GRAZ.

[vijkrish]

http://www.cisco.com/warp/customer/110/38.html

shows simple PIX-PIX vpn setup that you describe. If things are not working when you setup as per the sample, please elaborate as to what exactly is not working (ie., need more info. than the mention "ipsec doesnt' work").

Do you see Phase1 SAs on both the PIX ?

Do you see Phase2 SAs on both the PIX ?

Do you see counters of encaps and encrypt increase on the sending PIX

when you do a show crypto ipsec sa ?

Do you see counters of decaps and decrypt increase on the receiving PIX ?

Please post those details to specifically see what exactly is not working.

Vijay.